This is the practical answer, and it is far less exotic than the name suggests. These are ordinary programs running on ordinary computers — your laptop, your phone, your router.
The only thing that changed is the puzzle underneath. These are built on math problems that neither Shor nor Grover knows how to crack.
| Hard problem | Standard | Role | |
|---|---|---|---|
| Lattices | ML-KEM (FIPS 203) | key encapsulation | the default choice; was CRYSTALS-Kyber |
| Lattices | ML-DSA (FIPS 204) | signatures | was CRYSTALS-Dilithium |
| Hashes | SLH-DSA (FIPS 205) | signatures | conservative, large, was SPHINCS+ |
| Codes | HQC | key encapsulation | selected 2025 as a non-lattice backup |
What got made official
After an eight-year public competition, the American standards body NIST published the first three in August 2024:
ML-KEM — for agreeing on a key. This is the direct replacement for the thing your browser does today.
ML-DSA — for signatures. The general-purpose replacement for proving who you are.
SLH-DSA — also for signatures, but built on nothing more exotic than hash functions. Its security assumptions are about as boring and well-tested as cryptography gets. The price is that its signatures are large and slow to make.
Then in March 2025 they added HQC, a backup for key agreement built on completely different math.
The puzzles underneath
Grids of points in many dimensions. Finding the shortest hop between them gets hopeless very fast. Quick to compute with and reasonably compact, which is why this family dominates.
Hash functions. Nothing but "you cannot find two inputs that collide". The most conservative assumption available, at the cost of size.
Error-correcting codes. Proposed in 1978 and still standing — the oldest surviving candidate. Its keys are enormous.
What changes for you
The programs drop into existing protocols. The sizes do not drop in quite so neatly.
1,184 bytes
A new key, versus 32 bytes for the one it replaces
2,420 bytes
A new signature, versus 64 bytes today
Plenty fast
Speed is fine — often faster than what we use now
Bigger keys mean more data in every connection. That matters for small devices, for protocols with tight limits, and for anything that carries certificates around. Speed is generally not the problem. Size is.
Worth remembering
- These run on ordinary computers. Only the underlying puzzle changed.
- NIST published ML-KEM, ML-DSA and SLH-DSA in August 2024, then added HQC in March 2025.
- HQC is a deliberate backup built on unrelated math.
- Keys and signatures are much bigger. Speed is usually fine.